Hybrid method for distributing keys for the diffusion of encrypted data

Abstract

The invention relates to a method for broadcasting data in a system using a BES (A 1 ) stateless scheme using a binary tree T with a KEKs No 2 key structure, i.e. such that a key k i,j is associated with each difference of subsets S i,j , and a root key k 0, - - - associated with the set of the tree T and a BES (A 2 ) “stateful” scheme using the same binary tree T with a KEKs No 1 key structure, i.e. such that a key k i is associated with each subtree S i wherein the scheme (A 1 ) is used for the current broadcast session and the keys known by the denied users are updated with a “stateful” scheme (A 2 ) from time to time.

The invention claimed is: 
     
       1. A method of broadcasting data in a system, said method implemented by a broadcast encryption apparatus, said method comprising:
 using a stateless scheme (A 1 ) that includes
 a binary tree T with a KEKs No 2 encryption key structure, wherein a key k i,j  is associated with each difference of subsets S i,j =S i −S j , S i  and S j  are two subtrees, and subtree S i  contains the subtree S j , and 
 a root key k 0, - - -  associated with the binary tree T; and 
 
 using a stateful scheme (A 2 ) that includes
 a binary tree T with a KEKs No 1 encryption key structure, wherein a key k i  is associated with each subtree S i , 
 wherein the stateless scheme (A 1 ) is used for a current broadcast session, the keys known by denied users are updated with the stateful scheme (A 2 ) from time to time, combining the stateless scheme (A 1 ) and the stateful scheme (A 2 ) to determine a set {L ij } from the sets {k ij } and {k i } of the stateless scheme (A 1 ) and the stateful scheme (A 2 ), respectively, 
 wherein the keys k i,j  and k 0, - - -  are static encryption keys defined by the stateless scheme (A 1 ) and have a length in bits marked N s , and the keys k i  are dynamic encryption keys defined by the stateful scheme (A 2 ) and have a length in bits marked N d , 
 
 using function F with inputs in {0,1} Ns ×{0,1} Nd  and outputs in {0,1} Ns  to calculate z=F(x,y) from any (x,y) belonging to {0,1} Ns ×{0,1} Nd  and for any triplet (x,y,z) wherein z=F(x,y), it is impossible to find z if no information on y is possessed, even if x is known, 
 for each index i of a node v i  of the tree, and for each index j of a node v j  belonging to the subtree S i , defining the following variable encryption keys:
 L i,j =F(k i,j , k i ) calculated from the static encryption key k i,j  and the dynamic encryption key k i , 
 L 0, - - - =F(k 0, - - -  , k 0 ) calculated from the static key k 0, - - -  and the dynamic key k 0 , 
 
 each session t, using the variable encryption keys of the stateless scheme (A 1 ) to broadcast the data to the authorized users, wherein said data to be broadcasted is marked M t , and A 1 [M t , {L i,j }] is sent, 
 each T session, where T is a parameter, using the stateful scheme (A 2 ) to renew the dynamic keys shared by the authorized and revoked users, wherein an item of information I(D) is sent by giving the date D of operational application of the set of renewed encryption keys, and A 2 [M, {k i }, {k′ i }] and I(D) is sent, and 
 on the date D, the set of keys {k′ i }, replacing the set of keys {L ij } with a new set {L′ i,j } where L′ i,j =F(k ij , k′ i ). 
 
     
     
       2. A method of broadcasting data according to  claim 1  used in a satellite wireless navigation service, 
       wherein
 said satellite wireless navigation service is protected each day t by a traffic key K T (t), and 
 each day t, a service supplies to the authorized users a message M t  to be broadcasted and containing one or more future traffic keys giving potential access to a service S for future days. 
 
     
     
       3. A method of broadcasting data according to  claim 1  used in a satellite wireless navigation service, 
       wherein
 said satellite wireless navigation service is protected each day t by a traffic key K T (t), and 
 each day t, a service supplies to the authorized users the data M t  containing one or more future traffic keys giving potential access to a service S for future days. 
 
     
     
       4. A method of broadcasting data according to  claim 1 , wherein the function F is a one-way function which is applies to the combined stateless scheme (A 1 ) and stateful scheme (A 2 ). 
     
     
       5. A method of broadcasting data according to  claim 1 , wherein the variable encryption keys L i,j  and L 0, - - -  have same lengths as the static encryption keys k i,j  and k 0, - - -  and are indexed in an identical manner.